openworkgraph 0.2.13 → 0.3.1

package/dist/operations/update.js

@@ -4,20 +4,39 @@ import { join, relative, isAbsolute, sep } from 'node:path';
 import { SERVICE_VERSION } from "../vendor/protocol/index.js";
 import { readInstance, requestInstance, startBackground, waitUntilStopped } from './lifecycle.js';
 const PACKAGE_NAME = 'openworkgraph';
+async function npmPath(args, spawnProcess) {
+    const invocation = process.platform === 'win32'
+        ? { command: process.env.ComSpec ?? process.env.COMSPEC ?? 'cmd.exe', args: ['/d', '/s', '/c', 'npm ' + args.join(' ')] }
+        : { command: 'npm', args };
+    return new Promise((resolve, reject) => {
+        const child = spawnProcess(invocation.command, invocation.args, { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 });
+        let output = '';
+        child.stdout?.on('data', chunk => { if (output.length < 8192)
+            output += chunk.toString('utf8'); });
+        child.once('error', reject);
+        child.once('close', code => code === 0 ? resolve(output.trim()) : reject(new Error('npm path query failed')));
+    });
+}
+/** Recognize the package actually running from npm exec/npx's cache, including custom cache roots. */
+export async function isNpxInstallation(cliPath, spawnProcess = spawn) {
+    try {
+        const cache = await npmPath(['config', 'get', 'cache'], spawnProcess);
+        if (!cache)
+            return false;
+        const npxRoot = await realpath(join(cache, '_npx'));
+        const runningPath = await realpath(cliPath);
+        const inside = relative(npxRoot, runningPath).split(sep);
+        return inside.length === 5 && inside[0] !== '..' && inside[0] !== '' && !isAbsolute(inside[0])
+            && inside[1] === 'node_modules' && inside[2] === PACKAGE_NAME && inside[3] === 'dist' && inside[4] === 'cli.js';
+    }
+    catch {
+        return false;
+    }
+}
 /** Compare the running package against npm's actual global package location. */
 export async function isGlobalNpmInstallation(cliPath, spawnProcess = spawn) {
-    const invocation = process.platform === 'win32'
-        ? { command: process.env.ComSpec ?? process.env.COMSPEC ?? 'cmd.exe', args: ['/d', '/s', '/c', 'npm root -g'] }
-        : { command: 'npm', args: ['root', '-g'] };
     try {
-        const root = await new Promise((resolve, reject) => {
-            const child = spawnProcess(invocation.command, invocation.args, { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 });
-            let output = '';
-            child.stdout?.on('data', chunk => { if (output.length < 8192)
-                output += chunk.toString('utf8'); });
-            child.once('error', reject);
-            child.once('close', code => code === 0 ? resolve(output.trim()) : reject(new Error('npm root failed')));
-        });
+        const root = await npmPath(['root', '-g'], spawnProcess);
         if (!root)
             return false;
         const installedPath = join(root, PACKAGE_NAME);

package/dist/plugins.d.ts

@@ -34,6 +34,10 @@ export interface PluginContract {
 /** Bounded pure JSON only: no getters, functions, cycles or exotic prototypes. */
 export declare function checkedJson(value: unknown, maxBytes?: number, maxDepth?: number): Json;
 export declare function readField(content: Json, field: string): Json | undefined;
+/** Validate explicit references against the exact prompt occurrence, including boundaries. */
+export declare function validSkillContent(content: Json): boolean;
+/** Keep explicit Codex provenance while removing host paths; re-selection is required. */
+export declare function portableSkillContent(content: Json): Json;
 export interface PluginInformation {
     state: 'available' | 'missing' | 'incompatible' | 'invalid';
     typeId: string;

package/dist/plugins.js

@@ -1,3 +1,4 @@
+import { isSkillName } from "./vendor/protocol/index.js";
 import { ServiceError } from './errors.js';
 const forbidden = new Set(['__proto__', 'prototype', 'constructor']);
 const builtins = new Set(['text', 'image', 'document', 'video', 'file', 'preview', 'execution', 'group']);
@@ -154,6 +155,37 @@ function validateContract(input) {
     }
     return c;
 }
+/** Validate explicit references against the exact prompt occurrence, including boundaries. */
+export function validSkillContent(content) {
+    if (!object(content) || content.skillReferences === undefined)
+        return true;
+    const refs = content.skillReferences;
+    if (!Array.isArray(refs) || refs.length > 1024 || typeof content.prompt !== 'string')
+        return false;
+    const prompt = content.prompt;
+    let end = 0;
+    for (const value of refs) {
+        if (!object(value) || Object.keys(value).some(key => !['skillId', 'source', 'name', 'start', 'end'].includes(key)))
+            return false;
+        const ref = value;
+        if (typeof ref.skillId !== 'string' || !ref.skillId.trim() || ref.skillId.length > 4096 || /[\x00-\x1f]/.test(ref.skillId) ||
+            !['openworkgraph', 'codex'].includes(ref.source) || !isSkillName(ref.name) ||
+            !Number.isSafeInteger(ref.start) || !Number.isSafeInteger(ref.end) || ref.start < end || ref.end > prompt.length ||
+            prompt.slice(ref.start, ref.end) !== '$' + ref.name ||
+            (ref.start > 0 && !/\s/.test(prompt[ref.start - 1])) || (ref.end < prompt.length && !/[\s.,!?;，。！？；]/.test(prompt[ref.end])))
+            return false;
+        end = ref.end;
+    }
+    return true;
+}
+/** Keep explicit Codex provenance while removing host paths; re-selection is required. */
+export function portableSkillContent(content) {
+    if (!object(content) || content.skillReferences === undefined)
+        return content;
+    if (!validSkillContent(content))
+        invalid('Invalid skill references');
+    return { ...content, skillReferences: content.skillReferences.map(ref => object(ref) && ref.source === 'codex' ? { ...ref, skillId: 'codex-unresolved:' + ref.name } : ref) };
+}
 export class PluginRegistry {
     db;
     constructor(db) {
@@ -209,7 +241,7 @@ export class PluginRegistry {
         }
         if (!contract)
             return { state: 'missing', typeId: type, schemaVersion, content, reason: 'Resource contract is unavailable', contract: null };
-        const valid = matches(contract.contentSchema, content);
+        const valid = matches(contract.contentSchema, content) && (!builtins.has(type) || validSkillContent(content));
         return { state: valid ? 'available' : 'invalid', typeId: type, schemaVersion, content, reason: valid ? null : 'Content does not match schema', contract };
     }
     /** Pure copy-on-success migration. Caller persists new node version atomically; old version is never changed. */

package/dist/runtime-backend.d.ts

@@ -5,6 +5,7 @@ import { Runs } from './runs.js';
 import { ProjectProbe } from './project-probe.js';
 import { type DataDirectories } from './directories.js';
 import { RunContexts } from './run-context.js';
+import type { SkillSessions } from './skill-sessions.js';
 export declare function backendReply(interaction: Interaction, answer: Json): BackendReply;
 /** Trusted host bridge. Never accepts browser paths or creates isolation evidence. */
 export declare class RuntimeBackend implements SchedulerBackend {
@@ -12,9 +13,10 @@ export declare class RuntimeBackend implements SchedulerBackend {
     readonly dirs: DataDirectories;
     readonly adapter: BackendAdapter;
     readonly probe: ProjectProbe;
+    readonly skillSessions?: SkillSessions | undefined;
     private readonly contexts;
     readonly runContexts: RunContexts;
-    constructor(runs: Runs, dirs: DataDirectories, adapter: BackendAdapter, probe?: ProjectProbe);
+    constructor(runs: Runs, dirs: DataDirectories, adapter: BackendAdapter, probe?: ProjectProbe, skillSessions?: SkillSessions | undefined);
     private snapshot;
     start(run: Run, snapshot: InputSnapshot, context: BackendContext): Promise<void>;
     queryHistory(runId: string, query: string): string;

package/dist/runtime-backend.js

@@ -29,13 +29,15 @@ export class RuntimeBackend {
     dirs;
     adapter;
     probe;
+    skillSessions;
     contexts = new Map();
     runContexts;
-    constructor(runs, dirs, adapter, probe = new ProjectProbe()) {
+    constructor(runs, dirs, adapter, probe = new ProjectProbe(), skillSessions) {
         this.runs = runs;
         this.dirs = dirs;
         this.adapter = adapter;
         this.probe = probe;
+        this.skillSessions = skillSessions;
         this.runContexts = new RunContexts(runs, dirs);
     }
     snapshot(snapshot, context, expectedRunId) {
@@ -83,6 +85,11 @@ export class RuntimeBackend {
         let inputFiles;
         let upstreamContext;
         try {
+            if (snapshot.skills?.length) {
+                if (!this.skillSessions)
+                    throw new ServiceError('INPUT_BLOCKED', '冻结技能上下文不可用。');
+                await this.skillSessions.environment(snapshot.skills, true);
+            }
             if (runtime.details.kind === 'execution')
                 upstreamContext = this.runContexts.lineage(run.id);
             const inspect = await this.probe.inspect([path]);
@@ -144,7 +151,7 @@ export class RuntimeBackend {
             context.emit({ type: 'stopped' });
             return;
         }
-        const result = await this.adapter.start({ runId: run.id, kind: runtime.details.kind, projectPath: path, inputPath: directories.input, outputPath: directories.output, serviceRoot: this.dirs.root, prompt: snapshot.prompt, resources: snapshot.resources, projectFiles: snapshot.projectFiles ?? [], files: inputFiles, model: snapshot.model, ...(upstreamContext ? { upstreamContext } : {}), ...(snapshot.imageRoute?.type === 'codex' && snapshot.imageRoute.options ? { imageOptions: snapshot.imageRoute.options } : {}), sandboxMode: sandboxMode(runtime.details.sandboxMode ?? 'read-only') }, {
+        const result = await this.adapter.start({ runId: run.id, kind: runtime.details.kind, projectPath: path, inputPath: directories.input, outputPath: directories.output, serviceRoot: this.dirs.root, prompt: snapshot.prompt, resources: snapshot.resources, projectFiles: snapshot.projectFiles ?? [], files: inputFiles, model: snapshot.model, skills: snapshot.skills ?? [], ...(upstreamContext ? { upstreamContext } : {}), ...(snapshot.imageRoute?.type === 'codex' && snapshot.imageRoute.options ? { imageOptions: snapshot.imageRoute.options } : {}), sandboxMode: sandboxMode(runtime.details.sandboxMode ?? 'read-only') }, {
             onSnapshot: value => this.snapshot(value, context, run.id),
             onInteraction: value => {
                 if (!this.runs.db.prepare('SELECT 1 FROM runs WHERE id=?').get(run.id))
@@ -160,6 +167,8 @@ export class RuntimeBackend {
             },
             queryHistory: async (query) => this.queryHistory(run.id, query),
             readRunContext: async (request) => this.runContexts.read(run.id, request),
+            ...(this.skillSessions ? { skillEnvironment: async (skillId) => this.skillSessions.forSkill(snapshot.skills ?? [], skillId) } : {}),
+            ...(this.skillSessions ? { withSkillEnvironment: (skillId, dispatch) => this.skillSessions.withEnvironment(snapshot.skills ?? [], skillId, dispatch) } : {}),
         });
         this.snapshot(result, context, run.id);
     }

package/dist/runtime.d.ts

@@ -17,12 +17,16 @@ import type { DataDirectories } from './directories.js';
 import { ExecutionSettingsStore } from './execution-settings.js';
 import { ImageProviders } from './image-providers.js';
 import { ImageCredentials } from './image-credentials.js';
+import { BuiltinSkills, type BuiltinSkillsOptions } from './builtin-skills.js';
+import { SkillConfigs } from './skill-configs.js';
+import { SkillSessions } from './skill-sessions.js';
 export interface WorkflowRuntimeOptions {
     backend?: SchedulerBackend;
     models?: BackendModel[];
     /** Default: discover on model reads/submission. True also probes at startup; false disables execution and discovery. */
     enableBackend?: boolean;
     backendOptions?: AdapterOptions;
+    skillsOptions?: BuiltinSkillsOptions;
 }
 export declare class WorkflowRuntime {
     readonly db: DatabaseSync;
@@ -44,6 +48,9 @@ export declare class WorkflowRuntime {
     readonly executionSettings: ExecutionSettingsStore;
     readonly imageProviders: ImageProviders;
     readonly imageCredentials: ImageCredentials;
+    readonly skills: BuiltinSkills;
+    readonly skillConfigs: SkillConfigs;
+    readonly skillSessions: SkillSessions;
     private readonly probe;
     private readonly adapter;
     private availableModels;

package/dist/runtime.js

@@ -29,6 +29,9 @@ import { ImageProviders } from './image-providers.js';
 import { ImageCredentials } from './image-credentials.js';
 import { ApiImageAgent, RoutedImageBackend } from './api-image-agent.js';
 import { planOpenAiImage, discoverOpenAiModels } from './openai-image-driver.js';
+import { BuiltinSkills } from './builtin-skills.js';
+import { SkillConfigs } from './skill-configs.js';
+import { SkillSessions } from './skill-sessions.js';
 class RuntimeRuns extends Runs {
     available;
     constructor(db, serviceId, dependencies, available) {
@@ -62,6 +65,9 @@ export class WorkflowRuntime {
     executionSettings;
     imageProviders;
     imageCredentials;
+    skills;
+    skillConfigs;
+    skillSessions;
     probe = new ProjectProbe();
     adapter;
     availableModels;
@@ -88,6 +94,9 @@ export class WorkflowRuntime {
         this.executionSettings = new ExecutionSettingsStore(db);
         this.imageCredentials = new ImageCredentials(directories, serviceId);
         this.imageProviders = new ImageProviders(db, this.imageCredentials);
+        this.skills = new BuiltinSkills(directories, serviceId, options.skillsOptions);
+        this.skillConfigs = new SkillConfigs(directories, serviceId);
+        this.skillSessions = new SkillSessions(this.skills, this.skillConfigs, options.backendOptions);
         this.inputs = new InputPreparation(db, { plugins: this.plugins, readRepresentation: resource => this.resources.readPreparedRepresentation(resource) });
         this.models = new ModelDefaultsStore(db);
         this.runs = new RuntimeRuns(db, serviceId, { freeze: () => { throw new ServiceError('INPUT_BLOCKED', 'Use prepareSubmission outside the auth transaction'); }, ...(!options.backend ? { validateReply: (interaction, answer) => { backendReply(interaction, answer); } } : {}) }, (_run, snapshot) => snapshot.imageRoute?.type === 'api'
@@ -97,7 +106,7 @@ export class WorkflowRuntime {
         this.publication = new Publication(db, directories, this.resources, this.graphs, this.runs);
         this.executionChains = new ExecutionChains(this.runs, this.graphs, this.resources);
         this.adapter = options.backend ? undefined : new CodexBackendAdapter(options.backendOptions);
-        const codexBackend = options.backend ?? new RuntimeBackend(this.runs, directories, this.adapter, this.probe);
+        const codexBackend = options.backend ?? new RuntimeBackend(this.runs, directories, this.adapter, this.probe, this.skillSessions);
         const backend = new RoutedImageBackend(codexBackend, new ApiImageAgent(this.runs, this.resources, this.imageProviders, this.imageCredentials, directories), this.runs);
         this.scheduler = new Scheduler(this.runs, backend, { publish: (run, token) => this.publication.publish(run, token), acquireProjectLock: (_run, path) => acquireProjectLock(path) });
     }
@@ -320,6 +329,11 @@ export class WorkflowRuntime {
         }
         const scopedInputs = new InputPreparation(this.db, { plugins: this.plugins, readRepresentation: resource => prepared.get(resourceKey(resource)) ?? null });
         const scopedPreview = scopedInputs.inputPreview(request.graphId, request.nodeId, !!apiRoute);
+        const targetContent = this.db.prepare('SELECT v.content FROM nodes n JOIN node_versions v ON v.node_id=n.id AND v.version=n.current_version WHERE n.id=? AND n.graph_id=?').get(request.nodeId, request.graphId);
+        const skillReferences = targetContent ? JSON.parse(String(targetContent.content)).skillReferences : undefined;
+        if (apiRoute && Array.isArray(skillReferences) && skillReferences.length)
+            throw new ServiceError('INPUT_BLOCKED', '独立图片 API 不支持技能引用，请切换到 Codex 或移除技能引用。');
+        const frozenSkills = apiRoute ? [] : await this.skillSessions.freeze(scopedPreview.prompt, skillReferences, path);
         if (apiRoute) {
             const references = [];
             for (const envelope of scopedPreview.resources) {
@@ -357,7 +371,7 @@ export class WorkflowRuntime {
             },
             freeze: () => scopedInputs.build(request.graphId, request.nodeId, apiRoute
                 ? { expectedExecutionRevision: request.expectedExecutionRevision, imageRoute: apiRoute }
-                : { expectedExecutionRevision: request.expectedExecutionRevision, model: this.models.freeze(request.modelOverride, this.availableModels), ...(request.kind === 'image_generation' ? { imageRoute: request.imageRoute?.type === 'codex' ? request.imageRoute : { type: 'codex' } } : {}) }),
+                : { expectedExecutionRevision: request.expectedExecutionRevision, model: this.models.freeze(request.modelOverride, this.availableModels), skills: frozenSkills, ...(request.kind === 'image_generation' ? { imageRoute: request.imageRoute?.type === 'codex' ? request.imageRoute : { type: 'codex' } } : {}) }),
         });
         return principal => scoped.submit(request, principal, request.kind === 'execution' && holdExecution);
     }
@@ -380,6 +394,7 @@ export class WorkflowRuntime {
         else {
             this.requireAvailable({ kind: token.details.kind });
             await this.refreshModels();
+            await this.skillSessions.environment(snapshot.skills ?? [], true);
         }
         const project = this.db.prepare('SELECT state,canonical_path FROM projects WHERE id=?').get(run.projectId);
         if (!project || project.state !== 'active')

package/dist/service.d.ts

@@ -11,6 +11,7 @@ export declare function createService(dataDir?: string, options?: {
     projectProbe?: ProjectProbe;
     runtime?: WorkflowRuntimeOptions;
     npmInstallation?: () => Promise<boolean>;
+    npxInstallation?: () => Promise<boolean>;
     latestNpmVersion?: () => Promise<string>;
     updateRuntime?: (onExit: () => void) => Promise<void>;
 }): {

package/dist/service.js

@@ -58,6 +58,7 @@ export function createService(dataDir, options = {}) {
     const events = new Events(db, serviceId, auth);
     const instanceId = randomUUID();
     const npmInstallation = options.npmInstallation ?? (async () => false);
+    const npxInstallation = options.npxInstallation ?? (async () => false);
     let updateQueued = false;
     const unavailable = {
         status: "unavailable",
@@ -136,14 +137,15 @@ export function createService(dataDir, options = {}) {
             const rawPath = request.url ?? "";
             const fileRoute = /^[/]v1[/]projects[/][a-zA-Z0-9_-]+[/]files(?:[/](?:search|content|link-content|media|thumbnail|stat))?(?:[?]|$)/.test(rawPath);
             const skillsRoute = /^[/]v1[/]projects[/][a-zA-Z0-9_-]+[/]skills[/]search(?:[?]|$)/.test(rawPath);
+            const skillsManagementRoute = /^[/]v1[/]skills(?:[/][^/?#]+(?:[/](?:install|update|uninstall|config|files))?)?(?:[?]|$)/.test(rawPath);
             const mediaRoute = /^[/]v1[/]projects[/][a-zA-Z0-9_-]+[/](?:assets[/][a-zA-Z0-9_-]+[/]versions[/][1-9][0-9]*|graphs[/][a-zA-Z0-9_-]+[/]resources[/][a-zA-Z0-9_-]+[/]versions[/][1-9][0-9]*)[/](?:thumbnail|preview|content)(?:[?]|$)/.test(rawPath);
-            const queryRoute = fileRoute || skillsRoute || mediaRoute;
+            const queryRoute = fileRoute || skillsRoute || skillsManagementRoute || mediaRoute;
             const path = queryRoute ? rawPath.split('?')[0] : rawPath;
             if (!path.startsWith("/") ||
                 path.startsWith("//") ||
                 (!queryRoute && path.includes("?")) ||
                 path.includes("#") ||
-                path.includes("%") ||
+                (!skillsManagementRoute && path.includes("%")) ||
                 path.includes("\\"))
                 throw new ServiceError("INVALID_REQUEST", "请使用标准 API 路径；凭据只能放在 Authorization 请求头，不能放入 URL。");
             if (queryRoute && (rawPath.includes('#') || rawPath.length > 8192 || rawPath.split('?').length > 2))
@@ -170,11 +172,12 @@ export function createService(dataDir, options = {}) {
                     .split(",")
                     .map((value) => value.trim())
                     .filter(Boolean);
+                const allowedMethods = /^[/]v1[/]skills[/][^/]+[/]config$/.test(path) ? ["GET", "POST", "PUT", "DELETE"] : ["GET", "POST", "DELETE"];
                 if (typeof method !== "string" ||
-                    !["GET", "POST", "DELETE"].includes(method) ||
+                    !allowedMethods.includes(method) ||
                     headers.some((header) => !CORS_HEADERS.includes(header)))
                     throw new ServiceError("ORIGIN_DENIED", "不允许的跨来源方法或请求头。");
-                response.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE");
+                response.setHeader("Access-Control-Allow-Methods", allowedMethods.join(", "));
                 response.setHeader("Access-Control-Allow-Headers", CORS_HEADERS.join(", "));
                 response.setHeader("Access-Control-Max-Age", "300");
                 response.writeHead(204);
@@ -200,7 +203,7 @@ export function createService(dataDir, options = {}) {
                 const runtimeInfo = runtime.serviceInfo;
                 send({
                     ...info,
-                    installation: await npmInstallation() ? 'npm-global' : 'other',
+                    installation: await npmInstallation() ? 'npm-global' : await npxInstallation() ? 'npx' : 'other',
                     imageRoutes: runtimeInfo.imageRoutes,
                     capabilities: {
                         ...info.capabilities,
@@ -288,7 +291,7 @@ export function createService(dataDir, options = {}) {
                 events.stream(request, response, token, origin);
                 return;
             }
-            const business = await api.handle(request, fileRoute || skillsRoute ? rawPath : path, token, origin);
+            const business = await api.handle(request, fileRoute || skillsRoute || skillsManagementRoute ? rawPath : path, token, origin);
             if (business.handled) {
                 const body = auth.withSession(token, origin, (current) => business.binary ?? (business.binaryParts ? undefined : events.decorate(business.body, current.id)));
                 if (business.status)
@@ -468,13 +471,29 @@ export function createService(dataDir, options = {}) {
         db.prepare("INSERT INTO settings(key,value) VALUES('listener',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").run(JSON.stringify(listenerInfo(address, serviceId, instanceId)));
     });
     let closing;
+    async function closeHttpServer() {
+        if (!server.listening)
+            return;
+        await new Promise((resolve, reject) => {
+            // Runs and event streams have already drained. A browser's unfinished
+            // request must not hold the service's lifetime locks indefinitely.
+            const timeout = setTimeout(() => server.closeAllConnections(), 1000);
+            timeout.unref();
+            server.close(error => {
+                clearTimeout(timeout);
+                if (error)
+                    reject(error);
+                else
+                    resolve();
+            });
+        });
+    }
     async function abortStartup() {
         runtime.disposeUnstarted();
         projectProbe.close();
         events.close();
         try {
-            if (server.listening)
-                await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
+            await closeHttpServer();
         }
         finally {
             db.close();
@@ -487,8 +506,7 @@ export function createService(dataDir, options = {}) {
             projectProbe.close();
             events.close();
             try {
-                if (server.listening)
-                    await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
+                await closeHttpServer();
                 db.prepare("DELETE FROM settings WHERE key='listener' AND json_extract(value,'$.instanceId')=?").run(instanceId);
             }
             finally {

package/dist/skill-configs.d.ts

@@ -0,0 +1,43 @@
+import type { SkillConfigSchema, SkillConfiguration, SkillConfigurationWrite } from "./vendor/protocol/index.js";
+import type { DataDirectories } from './directories.js';
+/** Omit schema to validate an automatic skill without loading its env/defaults. */
+export interface SkillConfigRevisionRequest {
+    skillId: string;
+    revision: number;
+    schema?: SkillConfigSchema;
+}
+/** Workspace-private, immutable revisions. Uninstall deliberately does not call clear. */
+export declare class SkillConfigs {
+    private readonly directories;
+    private readonly serviceId;
+    private sid;
+    constructor(directories: DataDirectories, serviceId: string);
+    private windowsSid;
+    private windowsAcl;
+    private directory;
+    private locked;
+    private claim;
+    private owner;
+    private dead;
+    private recover;
+    private load;
+    private manifest;
+    private removeRevoked;
+    private snapshot;
+    private atomic;
+    private effective;
+    private view;
+    read(skillId: string, schema: SkillConfigSchema): Promise<SkillConfiguration>;
+    write(skillId: string, schema: SkillConfigSchema, body: SkillConfigurationWrite): Promise<SkillConfiguration>;
+    clear(skillId: string, expectedRevision: number): Promise<SkillConfiguration>;
+    revision(skillId: string): Promise<number>;
+    hasRevision(skillId: string, revision: number): Promise<boolean>;
+    environment(skillId: string, schema: SkillConfigSchema, revision: number): Promise<Record<string, string>>;
+    private snapshotEnvironment;
+    /** Deterministic multi-skill locking prevents clear between the final revision
+     * check, secret read, and synchronous spawn/request. No nested public store
+     * methods may be awaited inside dispatch. Never await a returned command. */
+    withRevisions<T>(requests: readonly SkillConfigRevisionRequest[], dispatch: (environments: ReadonlyMap<string, Record<string, string>>) => T): Promise<{
+        value: T;
+    }>;
+}